• disclaimer
  • about-us

    • What is IKEv2? How to configure IKEv2?

    Internetworks April 03, 2024
     

    Internet Key Exchange or IKE Is used by IPsec to establish security parameters between two sites. IKE allows us to exchange keys securely used for encryption and authentication over the internet. In the previous blog we discussed KE click here  

    IKEv2 phase 2 is also known as child mode. the IKEv2 initiator sends a CREATE_CHILD_SA request, containing a list of acceptable proposals for the child SA.

     R3#show crypto ikev2 session
     IPv4 Crypto IKEv2 Session
     
    Session-id:1, Status:UP-ACTIVE, IKE count:1, CHILD count:1
     
    Tunnel-id Local                 Remote                fvrf/ivrf            Status
    1         192.168.31.1/500      192.168.123.1/500     none/none            READY
          Encr: 3DES, Hash: SHA96, DH Grp:5, Auth sign: PSK, Auth verify: PSK
          Life/Active Time: 86400/2923 sec
    Child sa:     local selector  192.168.30.0/0 - 192.168.30.255/65535
              remote selector 192.168.10.0/0 - 192.168.10.255/65535
              ESP spi in/out: 0xCF0FA2FE/0x5AAC2F32
     
     IPv6 Crypto IKEv2 Session






    The attributes that can be negotiated include the following:

    Protocol (AH 0r ESP) AH, and ESP are the two protocols we use to protect user data. Both of them can be used in transport or tunnel mode, let’s see all the possible options.

    Encapsulation mode (tunnel or transport) Transport mode is very simple, it just adds an AH header just after the IP header. Here’s an example of an IP packet that carries some TCP traffic:

    Encryption algorithm (for example DES,3DES, or AES)

    Authentication algorithm (for example, HMAC-MD5 or HMAC-SHA) peers have to show their identity to prove who he is. Peers use shared keys or digital certificates.

    Diffle-hellman group information (for example, group 1, group 2, group 5, or group 14) DH group determines how strong the key is and how it's used in the exchange process of the key. The higher number means more secure but it takes longer to compute.

    CLICK HERE FOR MORE TO LEARN







    For gns3 IKEv2 supported in IOS 15.1.1t

     


    To configure IKEv2 simple only 8 steps:-
    1. Interesting traffic (ACL)
    2. IKEv2 Proposal
    3. IKEv2 Policy 
    4. IKEv2 Keyring
    5. IKEv2 Profile
    6. IPsec Transform set
    7. Crypto map
    8. Apply Map on an interface



    Let's see the configuration:-

    Topology:-




    Goal: 

    • Configure the topology as per the diagram
    • Configure the IP addresses as per the topology
    • Configure ACL and permit Fa0/0 traffic
    • Configure IKEv2 Proposal
    • Configure IKEv2 Policy
    • Configure  IKEv2 Keyring
    • Configure IKEv2 Profile
    • Configure Transform set
    • Configure Crypto map
    • Apply Crypto map on an interface   
    • verify with show commands and ping 



    R1(config)#interface serial 3/0
    R1(config-if)#ip address 192.168.123.1 255.255.255.0
    R1(config-if)#no shutdown
    R1(config-if)#exit

    R1(config)#interface fastethernet 0/0
    R1(config-if)#ip address 192.168.10.1 255.255.255.0
    R1(config-if)#no shutdown
    R1(config-if)#no keepalive
    R1(config-if)#exit

    R1(config)#ip route 0.0.0.0 0.0.0.0 serial 3/0


    R2(config)#interface serial 3/0
    R2(config-if)#ip address 192.168.123.2 255.255.255.0
    R2(config-if)#no shutdown
    R2(config-if)#exit

    R2(config)#interface serial 3/1
    R2(config-if)#ip address 192.168.31.2 255.255.255.0
    R2(config-if)#no shutdown
    R2(config-if)#exit

    R2(config)#ip route 192.168.10.0 255.255.255.0 serial 3/0
    R2(config)#ip route 192.168.30.0 255.255.255.0 serial 3/1



    R3(config)#interface serial 3/1
    R3(config-if)#ip address 192.168.31.1 255.255.255.0
    R3(config-if)#no shutdown
    R3(config-if)#exit

    R3(config)#interface fastethernet 0/0
    R3(config-if)#ip address 192.168.30.1 255.255.255.0
    R3(config-if)#no shutdown
    R3(config-if)#no keepalive
    R3(config-if)#exit

    R3(config)#ip route 0.0.0.0 0.0.0.0 serial 3/1


    R1(config)#do ping 192.168.30.1
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 192.168.30.1, timeout is 2 seconds:
    !!!!!
    Success rate is 100 percent (5/5), round-trip min/avg/max = 52/59/72 ms

     

    R1#show ip interface brief
    Interface              IP-Address      OK? Method Status                Protocol
    FastEthernet0/0        192.168.10.1    YES manual up                    up
    Serial3/0              192.168.123.1   YES manual up                    up

    R3(config)#do ping 192.168.10.1
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 192.168.10.1, timeout is 2 seconds:
    !!!!!
    Success rate is 100 percent (5/5), round-trip min/avg/max = 52/64/76 ms

     
    R3#show ip interface brief
    Interface              IP-Address      OK? Method Status                Protocol
    FastEthernet0/0        192.168.30.1    YES manual up                    up
    Serial3/1              192.168.31.1    YES manual up                    up




    R3#show ip route static
    Codes: L - local, C - connected, S - static, R - RIP, M - mobile, B - BGP
           D - EIGRP, EX - EIGRP external, O - OSPF, IA - OSPF inter area
           N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2
           E1 - OSPF external type 1, E2 - OSPF external type 2
           i - IS-IS, su - IS-IS summary, L1 - IS-IS level-1, L2 - IS-IS level-2
           ia - IS-IS inter area, * - candidate default, U - per-user static route
           o - ODR, P - periodic downloaded static route, H - NHRP, l - LISP
           + - replicated route, % - next hop override
     
    Gateway of last resort is 0.0.0.0 to network 0.0.0.0
     
    S*    0.0.0.0/0 is directly connected, Serial3/1
     


    Interesting traffic (ACL)



    R1(config)#ip access-list extended ACL-TRAFFIC
    R1(config-ext-nacl)# permit ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255
    R1(config-ext-nacl)#exit
     
    R1#show access-lists
    Extended IP access list ACL-TRAFFIC
        10 permit ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255 (6 matches)
     

    R3(config)#ip access-list extended ACL-TRAFFIC
    R3(config-ext-nacl)# permit ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255
    R3(config-ext-nacl)#exit

    R3#show access-list
    Extended IP access list ACL-TRAFFIC
        10 permit ip 192.168.30.0 0.0.0.255 192.168.10.0 0.0.0.255 (9 matches)



    IKEv2 Proposal



    R1(config)#crypto ikev2 proposal IKEV2-PROPOSAL
    IKEv2 proposal MUST have atleast an encryption algorithm, an integrity algorithm and a dh group configured
    R1(config-ikev2-proposal)# encryption 3des aes-cbc-128 aes-cbc-256
    R1(config-ikev2-proposal)# integrity sha1 sha256 sha384 sha512
    R1(config-ikev2-proposal)# group 5 2 14 15
    R1(config-ikev2-proposal)#exit
    R1(config)#exit
     
    R1#show crypto ikev2 proposal
     IKEv2 proposal: IKEV2-PROPOSAL
         Encryption : 3DES AES-CBC-128 AES-CBC-256
         Integrity  : SHA96 SHA256 SHA384 SHA512
         PRF        : SHA1 SHA256 SHA384 SHA512
         DH Group   : DH_GROUP_1536_MODP/Group 5 DH_GROUP_1024_MODP/Group 2     DH_GROUP_2048_MODP/Group 14 DH_GROUP_3072_MODP/Group 15
     IKEv2 proposal: default
         Encryption : AES-CBC-256 AES-CBC-192 AES-CBC-128
         Integrity  : SHA512 SHA384 SHA256 SHA96 MD596
         PRF        : SHA512 SHA384 SHA256 SHA1 MD5
         DH Group   : DH_GROUP_1536_MODP/Group 5 DH_GROUP_1024_MODP/Group 2



    R3(config)#crypto ikev2 proposal IKEV2-PROPOSAL
    IKEv2 proposal MUST have atleast an encryption algorithm, an integrity algorithm and a dh group configured
    R3(config-ikev2-proposal)# encryption 3des aes-cbc-128 aes-cbc-256
    R3(config-ikev2-proposal)# integrity sha1 sha256 sha384 sha512
    R3(config-ikev2-proposal)# group 5 2 14 15
    R3(config-ikev2-proposal)#exit
     
     
    R3#show crypto ikev2 proposal
     IKEv2 proposal: IKEV2-PROPOSAL
         Encryption : 3DES AES-CBC-128 AES-CBC-256
         Integrity  : SHA96 SHA256 SHA384 SHA512
         PRF        : SHA1 SHA256 SHA384 SHA512
         DH Group   : DH_GROUP_1536_MODP/Group 5 DH_GROUP_1024_MODP/Group 2 DH_GROUP_2048_MODP/Group 14 DH_GROUP_3072_MODP/Group 15
     IKEv2 proposal: default
         Encryption : AES-CBC-256 AES-CBC-192 AES-CBC-128
         Integrity  : SHA512 SHA384 SHA256 SHA96 MD596
         PRF        : SHA512 SHA384 SHA256 SHA1 MD5
         DH Group   : DH_GROUP_1536_MODP/Group 5 DH_GROUP_1024_MODP/Group 2




    IKEv2 Policy 




    R1(config)#crypto ikev2 policy IKEV2-POLICY
    IKEv2 policy MUST have atleast one complete proposal attached
    R1(config-ikev2-policy)# proposal IKEV2-PROPOSAL
    R1(config-ikev2-policy)#exit
    R1(config)#
     
     
    R1#show crypto ikev2 policy
     
     IKEv2 policy : IKEV2-POLICY
          Match fvrf  : global
          Match address local : any
          Proposal    : IKEV2-PROPOSAL22
     
     IKEv2 policy : default
          Match fvrf : any
          Match address local : any
          Proposal    : default




    R3(config)#crypto ikev2 policy IKEV2-POLICY
    IKEv2 policy MUST have atleast one complete proposal attached
    R3(config-ikev2-policy)# proposal IKEV2-PROPOSAL
    R3(config-ikev2-policy)#exit
     
     
    R3#show crypto ikev2 policy
     
     IKEv2 policy : IKEV2-POLICY
          Match fvrf  : global
          Match address local : any
          Proposal    : IKEV2-PROPOSAL
     
     IKEv2 policy : default
          Match fvrf : any
          Match address local : any
          Proposal    : default



    IKEv2 Keyring





    R1(config)#crypto ikev2 keyring IKEV2-KEYRING
    R1(config-ikev2-keyring)# peer R3
    R1(config-ikev2-keyring-peer)#  address 192.168.31.1
    R1(config-ikev2-keyring-peer)#  pre-shared-key local internet
    R1(config-ikev2-keyring-peer)#  pre-shared-key remote internet
    R1(config-ikev2-keyring-peer)# exit
    R1(config-ikev2-keyring)#exit



    R3(config)#crypto ikev2 keyring IKEV2-KEYRING
    R3(config-ikev2-keyring)# peer R1
    R3(config-ikev2-keyring-peer)#  address 192.168.123.1
    R3(config-ikev2-keyring-peer)#  pre-shared-key local internet
    R3(config-ikev2-keyring-peer)#  pre-shared-key remote internet
    R3(config-ikev2-keyring-peer)# exit
    R3(config-ikev2-keyring)#exit



    IKEv2 Profile




    R1(config)#crypto ikev2 profile IKEV2-PROFILE
    IKEv2 profile MUST have:
       1. A local and a remote authentication method.
       2. A match identity or a match certificate statement.
    R1(config-ikev2-profile)#match identity remote address 192.168.31.1 255.255.255.255
    R1(config-ikev2-profile)# authentication remote pre-share
    R1(config-ikev2-profile)# authentication local pre-share
    R1(config-ikev2-profile)# keyring local IKEV2-KEYRING
    R1(config-ikev2-profile)#exit
     
    R1#show crypto ikev2 profile IKEV2-PROFILE
     
    IKEv2 profile: IKEV2-PROFILE
     Ref Count: 2
     Match criteria:
      Fvrf: global
      Local address/interface: none
      Identities:
       address 192.168.31.1 255.255.255.255
      Certificate maps: none
     Local identity: none
     Remote identity: none
     Local authentication method: pre-share
     Remote authentication method(s): pre-share
     EAP options: none
     Keyring: IKEV2-KEYRING
     Trustpoint(s): none
     Lifetime: 86400 seconds
     DPD: disabled
     NAT-keepalive: disabled
     Ivrf: none
     Virtual-template: none
     AAA EAP authentication mlist: none
     AAA Accounting: none
     AAA group authorization: none
     AAA user authorization: none




    R3(config)#crypto ikev2 profile IKEV2-PROFILE
    IKEv2 profile MUST have:
       1. A local and a remote authentication method.
       2. A match identity or a match certificate statement.
    R3(config-ikev2-profile)#match identity remote address 192.168.123.1 255.255.255.255
    R3(config-ikev2-profile)# authentication remote pre-share
    R3(config-ikev2-profile)# authentication local pre-share
    R3(config-ikev2-profile)# keyring local IKEV2-KEYRING
    R3(config-ikev2-profile)#exit
     
    R3#show crypto ikev2 profile IKEV2-PROFILE
     
    IKEv2 profile: IKEV2-PROFILE
     Ref Count: 2
     Match criteria:
      Fvrf: global
      Local address/interface: none
      Identities:
       address 192.168.123.1 255.255.255.255
      Certificate maps: none
     Local identity: none
     Remote identity: none
     Local authentication method: pre-share
     Remote authentication method(s): pre-share
     EAP options: none
     Keyring: IKEV2-KEYRING
     Trustpoint(s): none
     Lifetime: 86400 seconds
     DPD: disabled
     NAT-keepalive: disabled
     Ivrf: none
     Virtual-template: none
     AAA EAP authentication mlist: none
     AAA Accounting: none
     AAA group authorization: none
     AAA user authorization: none


    Transform-set




    R1(config)#crypto ipsec transform-set TRANS-set esp-3des esp-md5-hmac
    R1(cfg-crypto-trans)#exit
     
    R1#show crypto ipsec transform-set
    Transform set default: { esp-aes esp-sha-hmac  }
       will negotiate = { Transport,  },
     
    Transform set TRANS-set: { esp-3des esp-md5-hmac  }
       will negotiate = { Tunnel,  },



    R3(config)#crypto ipsec transform-set TRANS-set esp-3des esp-md5-hmac
    R3(cfg-crypto-trans)#exit
     
     
    R3#show crypto ipsec transform-set
    Transform set default: { esp-aes esp-sha-hmac  }
       will negotiate = { Transport,  },
     
    Transform set TRANS-set: { esp-3des esp-md5-hmac  }
       will negotiate = { Tunnel,  }    ,



    Crypto Map


    R1(config)#crypto map CRYPTO-MAP 11 ipsec-isakmp
    % NOTE: This new crypto map will remain disabled until a peer
            and a valid access list have been configured.
    R1(config-crypto-map)# set peer 192.168.31.1
    R1(config-crypto-map)# set transform-set TRANS-set
    R1(config-crypto-map)# set ikev2-profile IKEV2-PROFILE
    R1(config-crypto-map)# match address ACL-TRAFFIC
    R1(config-crypto-map)#exit


    R1#show crypto map
    Crypto Map IPv4 "CRYPTO-MAP" 11 ipsec-isakmp
            Peer = 192.168.31.1
            IKEv2 Profile: IKEV2-PROFILE
            Extended IP access list ACL-TRAFFIC
                access-list ACL-TRAFFIC permit ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255
            Current peer: 192.168.31.1
            IKEV2 profile IKEV2-PROFILE
            Security association lifetime: 4608000 kilobytes/3600 seconds
            Responder-Only (Y/N): N
            PFS (Y/N): N
            Transform sets={
                    TRANS-set:  { esp-3des esp-md5-hmac  } ,
            }



     
     
    R3(config)#crypto map CRYPTO-MAP 11 ipsec-isakmp
    % NOTE: This new crypto map will remain disabled until a peer
            and a valid access list have been configured.
    R3(config-crypto-map)# set peer 192.168.123.1
    R3(config-crypto-map)# set transform-set TRANS-set
    R3(config-crypto-map)# set ikev2-profile IKEV2-PROFILE
    R3(config-crypto-map)# match address ACL-TRAFFIC
    R3(config-crypto-map)#exit
     
     
    R1#show crypto map
    Crypto Map IPv4 "CRYPTO-MAP" 11 ipsec-isakmp
            Peer = 192.168.31.1
            IKEv2 Profile: IKEV2-PROFILE
            Extended IP access list ACL-TRAFFIC
                access-list ACL-TRAFFIC permit ip 192.168.10.0 0.0.0.255 192.168.30.0 0.0.0.255
            Current peer: 192.168.31.1
            IKEV2 profile IKEV2-PROFILE
            Security association lifetime: 4608000 kilobytes/3600 seconds
            Responder-Only (Y/N): N
            PFS (Y/N): N
            Transform sets={
                    TRANS-set:  { esp-3des esp-md5-hmac  } ,
            }
           



    Applying the Crypto Map 



    R1(config)#interface serial 3/0
    R1(config-if)#crypto map CRYPTO-MAP
    R1(config-if)#exit

    *Apr  1 17:15:52.575: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON


    R1(config)#do ping 192.168.30.1 source fa 0/0
    Type escape sequence to abort.
    Sending 5, 100-byte ICMP Echos to 192.168.30.1, timeout is 2 seconds:
    Packet sent with a source address of 192.168.10.1
    .!!!!
    Success rate is 80 percent (4/5), round-trip min/avg/max = 52/69/92 ms
    R1(config)#end
     

     
    R1#show crypto ikev2 sa
     IPv4 Crypto IKEv2  SA
     
    Tunnel-id Local                 Remote                fvrf/ivrf            Status
    1         192.168.123.1/500     192.168.31.1/500      none/none            READY
          Encr: 3DES, Hash: SHA96, DH Grp:5, Auth sign: PSK, Auth verify: PSK
          Life/Active Time: 86400/2693 sec
     
     IPv6 Crypto IKEv2  SA
     
     
     
     
     R3(config)#interface serial 3/1
    R3(config-if)#crypto map CRYPTO-MAP
    R3(config-if)#exit
     
    *Apr  1 17:14:39.975: %CRYPTO-6-ISAKMP_ON_OFF: ISAKMP is ON

    R3#show crypto map interface serial 3/1
            Interfaces using crypto map CRYPTO-MAP:
                    Serial3/1
     
     
     


    Verify the IKEv2 IPsec 



     R3#show crypto ikev2 session
     IPv4 Crypto IKEv2 Session
     
    Session-id:1, Status:UP-ACTIVE, IKE count:1, CHILD count:1
     
    Tunnel-id Local                 Remote                fvrf/ivrf            Status
    1         192.168.31.1/500      192.168.123.1/500     none/none            READY
          Encr: 3DES, Hash: SHA96, DH Grp:5, Auth sign: PSK, Auth verify: PSK
          Life/Active Time: 86400/2923 sec
    Child sa: local selector  192.168.30.0/0 - 192.168.30.255/65535
              remote selector 192.168.10.0/0 - 192.168.10.255/65535
              ESP spi in/out: 0xCF0FA2FE/0x5AAC2F32
     
     IPv6 Crypto IKEv2 Session
     

     
     
    R1#ping 192.168.30.1 source 192.168.10.1 repeat 100
    Type escape sequence to abort.
    Sending 100, 100-byte ICMP Echos to 192.168.30.1, timeout is 2 seconds:
    Packet sent with a source address of 192.168.10.1
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
    Success rate is 100 percent (100/100), round-trip min/avg/max = 52/63/112 ms



    R1#show crypto ipsec sa
     
    interface: Serial3/0
        Crypto map tag: CRYPTO-MAP, local addr 192.168.123.1
     
       protected vrf: (none)
       local  ident (addr/mask/prot/port): (192.168.10.0/255.255.255.0/0/0)
       remote ident (addr/mask/prot/port): (192.168.30.0/255.255.255.0/0/0)
       current_peer 192.168.31.1 port 500
         PERMIT, flags={origin_is_acl,}
        #pkts encaps: 104, #pkts encrypt: 104, #pkts digest: 104
        #pkts decaps: 104, #pkts decrypt: 104, #pkts verify: 104
        #pkts compressed: 0, #pkts decompressed: 0
        #pkts not compressed: 0, #pkts compr. failed: 0
        #pkts not decompressed: 0, #pkts decompress failed: 0
        #send errors 0, #recv errors 0
     
         local crypto endpt.: 192.168.123.1, remote crypto endpt.: 192.168.31.1
         path mtu 1500, ip mtu 1500, ip mtu idb Serial3/0
         current outbound spi: 0xCF0FA2FE(3473908478)
         PFS (Y/N): N, DH group: none
     
         inbound esp sas:
          spi: 0x5AAC2F32(1521233714)
            transform: esp-3des esp-md5-hmac ,
            in use settings ={Tunnel, }
            conn id: 2, flow_id: 2, sibling_flags 80000040, crypto map: CRYPTO-MAP
            sa timing: remaining key lifetime (k/sec): (4184586/795)
            IV size: 8 bytes
            replay detection support: Y
            Status: ACTIVE(ACTIVE)
     
         inbound ah sas:
     
         inbound pcp sas:
     
         outbound esp sas:
          spi: 0xCF0FA2FE(3473908478)
            transform: esp-3des esp-md5-hmac ,
            in use settings ={Tunnel, }
            conn id: 1, flow_id: 1, sibling_flags 80000040, crypto map: CRYPTO-MAP
            sa timing: remaining key lifetime (k/sec): (4184586/795)
            IV size: 8 bytes
            replay detection support: Y
            Status: ACTIVE(ACTIVE)
     
         outbound ah sas:
     
         outbound pcp sas:
     
     
     

     

     
    Read More

    What is DMVPN Phase 3? What is the difference between DMVPN phases 1, 2, and 3? How to configure DMVPN Phase 3?

    Internetworks January 28, 2024

     

    DMVPN (Dynamic Multipoint VPN) is a routing technology introduced by Cisco that allows you to build a VPN network with multiple sites without having to statically configure all devices. It uses a "hub and spoke" network topology, where the spokes can communicate directly without going through the hub. DMVPN supports encryption through IPsec, which makes it a popular choice for connecting different sites using regular Internet connections. It's a great backup or alternative to private networks like MPLS VPN. In other words, DMVPN combines mGRE + NHRP + DRP (dynamic routing protocol) and IPsec.





    let's take a look at all the technologies: -

    Multipoint GRE (mGRE)

    Our regular GRE tunnels are point-to-point and don’t scale well. It becomes messy quickly so many point-to-point tunnels. but When we use GRE Multipoint, there will be only one tunnel interface on each router. mGRE interfaces do not have a tunnel destination. It keeps costs low, minimizing configuration complexity, and increasing flexibility. Multipoint GRE(Mgre) Uses tunnel source and tunnel mode (mgre). The tunnel can have many endpoints by using a single tunnel interface. The endpoint can be configured as GRE or MGRE and Mapping is done by NHRP Protocol.

    https://mpls.internetworks.in/2021/02/what-is-network-tunneling-and-how-to.html


    NHRP (Next Hop Resolution Protocol)

    We want something that can help our router figure out what the public IP address is of the other router, we do this with the help of a protocol called NHRP (Next Hop Resolution Protocol). Next hop resolution protocol (NHRP)  Maps the tunnel IP with NBMA address (public IP ) (static or dynamic). NHRP Provides layer 2 address resolution protocol and caching services similar to ARP and inverse ARP. It only builds a dynamic database stored on the hub with information about spokes IP addresses.

    https://mpls.internetworks.in/2021/02/what-is-dmvpn-dynamic-multipoint-vpn.html


    Dynamic routing protocol

    Dynamic routing is used to find networks and update routing tables on routers dynamically. It is easier than using static or default routing, but it will cost you in terms of router CPU processing and bandwidth on network links.

    https://www.internetworks.in/2018/10/open-shortest-path-first-ospf-basic.html

    https://www.internetworks.in/2018/10/eigrp-basic.html


    IPsec encryption

    (Internet Protocol Security) IPSec is a set of protocols developed by the Internet Engineering Task Force (IETF). Internet protocol security (IPsec)  is a framework that helps us to protect our IP traffic on the network layer. Why? Because the ( internet protocol) IP protocol itself doesn’t have any security features at all. IPsec allows two or more hosts to communicate securely by authenticating and encrypting each IP packet of a communication session.

    https://mpls.internetworks.in/2021/07/what-is-ipsec-internet-protocol.html


    DMVPN has different three versions. we call phases.

    Phase 1 https://mpls.internetworks.in/2021/02/what-is-dmvpn-dynamic-multipoint-vpn.html

    Phase 2https://mpls.internetworks.in/2021/04/what-is-dmvpn-dynamic-multipoint-vpn.html
                 https://mpls.internetworks.in/2021/04/how-to-configure-eigrp-and-ospf-over.html

    Phase 3 In phase 3 we configure the (IP NHRP Redirect) command on the hub router and the IP NHRP shortcut command on the spokes routers.

    Let's see the configuration:-

    Topology:-






    • Configure the topology as per the diagram 
    • Configure the IP addresses as per the topology
    • Configure static and default route 
    • Configure the tunnel 192.168.1.0/24
    • Configure EIGRP 1 and advertise tunnel interface and LAN 
    • Configure NHRP Redirect on the HUB 
    • Configure NHRP Shortcut on the spokes
    • verify with show commands and trace commands.


    R1(config)#hostname Site-A-R-

    Site-A-R-(config)#interface serial 4/1
    Site-A-R-(config-if)#ip address 1.1.1.1 255.0.0.0
    Site-A-R-(config-if)#no shutdown
    Site-A-R-(config-if)#exit

    Site-A-R-(config)#interface fastethernet 0/0
    Site-A-R-(config-if)#ip address 10.1.1.1 255.0.0.0
    Site-A-R-(config-if)#no shutdown
    Site-A-R-(config-if)#no keepalive
    Site-A-R-(config-if)#exit
    Site-A-R-(config)#end


    Site-A-R-#show ip interface brief
    Interface                  IP-Address      OK? Method Status                Protocol
    FastEthernet0/0            10.1.1.1        YES manual up                    up                                                                                                                   
    Serial4/1                  1.1.1.1         YES manual up                    up                                                                                                                                                                                                                                                                               
    Site-A-R-# wr
    Building configuration...
    [OK]




    R2(config)#hostname Site-B-R-

    Site-B-R-(config)#interface serial 4/2
    Site-B-R-(config-if)#ip address 2.2.2.1 255.0.0.0
    Site-B-R-(config-if)#no shutdown
    Site-B-R-(config-if)#exit

    Site-B-R-(config)#interface fastEthernet 0/0
    Site-B-R-(config-if)#ip address 20.1.1.1 255.0.0.0
    Site-B-R-(config-if)#no shutdown
    Site-B-R-(config-if)#no keepalive
    Site-B-R-(config-if)#exit
    Site-B-R-(config)#end

    Site-B-R-#show ip interface brief
    Interface                  IP-Address      OK? Method Status                Protocol
    FastEthernet0/0            20.1.1.1        YES manual up                    up
    Serial4/2                  2.2.2.1         YES manual up                    up

    Site-B-R-#wr
    Building configuration...
    [OK]


    Site-C-R-(config)#interface serial 4/3
    Site-C-R-(config-if)#ip address 3.3.3.1 255.0.0.0
    Site-C-R-(config-if)#no shutdown
    Site-C-R-(config-if)#exit

    Site-C-R-(config)#interface fastethernet 0/0
    Site-C-R-(config-if)#ip address 30.1.1.1 255.0.0.0
    Site-C-R-(config-if)#no keepalive
    Site-C-R-(config-if)#no shutdown
    Site-C-R-(config-if)#exit
    Site-C-R-(config)#end

    Site-C-R-#show ip interface brief
    Interface                  IP-Address      OK? Method Status                Protocol
    FastEthernet0/0            30.1.1.1        YES manual up                    up
    Serial4/3                  3.3.3.1         YES manual up                    up

    Site-C-R-# wr
    Building configuration...
    [OK]


    R4(config)#hostname Site-D-R-

    Site-D-R-(config)#interface serial 4/4
    Site-D-R-(config-if)#ip address 4.4.4.1 255.0.0.0
    Site-D-R-(config-if)#no shutdown
    Site-D-R-(config-if)#exit

    Site-D-R-(config)#interface fastEthernet 0/0
    Site-D-R-(config-if)#ip address 40.1.1.1 255.0.0.0
    Site-D-R-(config-if)#no shutdown
    Site-D-R-(config-if)#exit

    Site-D-R-#show ip interface brief
    Interface                  IP-Address      OK? Method Status                Protocol
    FastEthernet0/0            40.1.1.1        YES manual up                    up
    Serial4/4                  4.4.4.1         YES manual up                    up

    Site-D-R-#wr
    Building configuration...
    [OK]


    R5(config)#hostname INTERNET-ROUTER-

    INTERNET-ROUTER-(config)#interface serial 4/1
    INTERNET-ROUTER-(config-if)#ip address 1.1.1.2 255.0.0.0
    INTERNET-ROUTER-(config-if)#no shutdown
    INTERNET-ROUTER-(config-if)#exit

    INTERNET-ROUTER-(config)#interface serial 4/2
    INTERNET-ROUTER-(config-if)#ip address 2.2.2.2 255.0.0.0
    INTERNET-ROUTER-(config-if)#no shutdown
    INTERNET-ROUTER-(config-if)#exit

    INTERNET-ROUTER-(config)#interface serial 4/3
    INTERNET-ROUTER-(config-if)#ip address 3.3.3.2 255.0.0.0
    INTERNET-ROUTER-(config-if)#no shutdown
    INTERNET-ROUTER-(config-if)#exit

    INTERNET-ROUTER-(config)#interface serial 4/4
    INTERNET-ROUTER-(config-if)#ip address 4.4.4.2 255.0.0.0
    INTERNET-ROUTER-(config-if)#no shutdown
    INTERNET-ROUTER-(config-if)#exit

    INTERNET-ROUTER-#show ip interface brief
    Interface                  IP-Address      OK? Method Status                Protocol

    Serial4/1                  1.1.1.2         YES manual up                    up
    Serial4/2                  2.2.2.2         YES manual up                    up
    Serial4/3                  3.3.3.2         YES manual up                    up
    Serial4/4                  4.4.4.2         YES manual up                    up

    INTERNET-ROUTER-#wr
    Building configuration...
    [OK]


    Site-A-R-(config)#ip route 0.0.0.0 0.0.0.0 serial 4/1
    Site-A-R-(config)#end

    Site-A-R-#show ip route static
    S*   0.0.0.0/0 is directly connected, Serial4/1

    Site-A-R-#wr
    Building configuration...
    [OK]


    Site-B-R-(config)#ip route 0.0.0.0 0.0.0.0 serial 4/2
    Site-B-R-(config)#end

    Site-B-R-#show ip route static
    S*   0.0.0.0/0 is directly connected, Serial4/2

    Site-B-R-#write
    Building configuration...
    [OK]


    Site-C-R-(config)#ip route 0.0.0.0 0.0.0.0 serial 4/3
    Site-C-R-(config)#end

    Site-C-R-#show ip route static
    S*   0.0.0.0/0 is directly connected, Serial4/3

    Site-C-R-#write
    Building configuration...
    [OK]

    Site-D-R-(config)#ip route 0.0.0.0 0.0.0.0 serial 4/4
    Site-D-R-(config)#end

    Site-D-R-#show ip route static
    S*   0.0.0.0/0 is directly connected, Serial4/4

    Site-D-R-#write
    Building configuration...
    [OK


    Site-A-R-(config)#interface tunnel 1
    Site-A-R-(config-if)#ip address 192.168.1.1 255.255.255.0
    Site-A-R-(config-if)#tunnel source 1.1.1.1
    Site-A-R-(config-if)#tunnel mode gre multipoint
    Site-A-R-(config-if)#ip nhrp network-id 1
    Site-A-R-(config-if)#ip nhrp map multicast dynamic
    Site-A-R-(config-if)#exit

    Site-A-R-#show interfaces tunnel 1
    Tunnel1 is up, line protocol is up
      Hardware is Tunnel
      Internet address is 192.168.1.1/24
      MTU 17916 bytes, BW 100 Kbit/sec, DLY 50000 usec,
         reliability 255/255, txload 1/255, rxload 1/255
      Encapsulation TUNNEL, loopback not set
      Keepalive not set
      Tunnel source 1.1.1.1
      Tunnel protocol/transport multi-GRE/IP








    Site-A-R-(config)#router eigrp 1
    Site-A-R-(config-router)#network 192.168.1.0
    Site-A-R-(config-router)#network 10.0.0.0
    Site-A-R-(config-router)#no au
    Site-A-R-(config-router)#no auto-summary
    Site-A-R-(config-router)#exit




    Site-A-R-(config)#interface tunnel 1
    Site-A-R-(config-if)#no ip split-horizon eigrp 1
    Site-A-R-(config-if)#ip next-hop-self eigrp 1
    Site-A-R-(config-if)#ip nhrp redirect
    Site-A-R-(config-if)#exit
    Site-A-R-(config)#end




    Site-B-R-(config)#interface tunnel 1
    Site-B-R-(config-if)#ip address 192.168.1.2 255.255.255.0
    Site-B-R-(config-if)#tunnel source 2.2.2.1
    Site-B-R-(config-if)#tunnel mode gre multipoint
    Site-B-R-(config-if)#ip nhrp network-id 2
    Site-B-R-(config-if)#ip nhrp map 192.168.1.1 1.1.1.1
    Site-B-R-(config-if)#ip nhrp nhs 192.168.1.1
    Site-B-R-(config-if)#ip nhrp map multicast 1.1.1.1
    Site-B-R-(config-if)#exit

    Site-B-R-#show interfaces tunnel 1
    Tunnel1 is up, line protocol is up
      Hardware is Tunnel
      Internet address is 192.168.1.2/24
      MTU 17916 bytes, BW 100 Kbit/sec, DLY 50000 usec,
         reliability 255/255, txload 1/255, rxload 1/255
      Encapsulation TUNNEL, loopback not set
      Keepalive not set
      Tunnel source 2.2.2.1
      Tunnel protocol/transport multi-GRE/IP



    Site-B-R-(config)#router eigrp 1
    Site-B-R-(config-router)#network 192.168.1.0
    Site-B-R-(config-router)#network 20.0.0.0
    Site-B-R-(config-router)#no auto-summary
    Site-B-R-(config-router)#exit




    Site-B-R-(config)#interface tunnel 1
    Site-B-R-(config-if)#ip nhrp shortcut
    Site-B-R-(config-if)#exit
    Site-B-R-(config)#end






    Site-B-R-#traceroute 10.1.1.1 source fastEthernet 0/0

    Type escape sequence to abort.
    Tracing the route to 10.1.1.1

      1 192.168.1.1 56 msec 56 msec 60 msec


    Site-C-R-(config)#interface tunnel 1
    Site-C-R-(config-if)#ip address 192.168.1.3 255.255.255.0
    Site-C-R-(config-if)#tunnel source 3.3.3.1
    Site-C-R-(config-if)#tunnel mode gre multipoint
    Site-C-R-(config-if)#ip nhrp network-id 3
    Site-C-R-(config-if)#ip nhrp map 192.168.1.1 1.1.1.1
    Site-C-R-(config-if)#ip nhrp nhs 192.168.1.1
    Site-C-R-(config-if)#ip nhrp map multicast 1.1.1.1
    Site-C-R-(config-if)#exit

    Site-C-R-#show interfaces tunnel 1
    Tunnel1 is up, line protocol is up
      Hardware is Tunnel
      Internet address is 192.168.1.3/24
      MTU 17916 bytes, BW 100 Kbit/sec, DLY 50000 usec,
         reliability 255/255, txload 1/255, rxload 1/255
      Encapsulation TUNNEL, loopback not set
      Keepalive not set
      Tunnel source 3.3.3.1
      Tunnel protocol/transport multi-GRE/IP



    Site-C-R-(config)#router eigrp 1
    Site-C-R-(config-router)#network 192.168.1.0
    Site-C-R-(config-router)#network 30.0.0.0
    Site-C-R-(config-router)#no auto-summary
    Site-C-R-(config-router)#exit

    Site-C-R-(config)#interface tunnel 1
    Site-C-R-(config-if)#ip nhrp shortcut
    Site-C-R-(config-if)#exit
    Site-C-R-(config)#end








    Site-C-R-#traceroute 10.1.1.1 source fastEthernet 0/0

    Type escape sequence to abort.
    Tracing the route to 10.1.1.1

      1 192.168.1.1 64 msec 64 msec 60 msec

    Site-C-R-#traceroute 20.1.1.1 source fastEthernet 0/0

    Type escape sequence to abort.
    Tracing the route to 20.1.1.1

      1 192.168.1.2 56 msec 64 msec 60 msec



    Site-D-R-(config)#interface tunnel 1
    Site-D-R-(config-if)#ip address 192.168.1.4 255.255.255.0
    Site-D-R-(config-if)#tunnel source 4.4.4.1
    Site-D-R-(config-if)#tunnel mode gre multipoint
    Site-D-R-(config-if)#ip nhrp network-id 4
    Site-D-R-(config-if)#ip nhrp map 192.168.1.1 1.1.1.1
    Site-D-R-(config-if)#ip nhrp nhs 192.168.1.1
    Site-D-R-(config-if)#ip nhrp map multicast 1.1.1.1
    Site-D-R-(config-if)#exit

    Site-D-R-#show interfaces tunnel 1
    Tunnel1 is up, line protocol is up
      Hardware is Tunnel
      Internet address is 192.168.1.4/24
      MTU 17916 bytes, BW 100 Kbit/sec, DLY 50000 usec,
         reliability 255/255, txload 1/255, rxload 1/255
      Encapsulation TUNNEL, loopback not set
      Keepalive not set
      Tunnel source 4.4.4.1
      Tunnel protocol/transport multi-GRE/IP


    Site-D-R-(config)#router eigrp 1
    Site-D-R-(config-router)#network 192.168.1.0
    Site-D-R-(config-router)#network 40.0.0.0
    Site-D-R-(config-router)#exit

    Site-D-R-(config)#interface tunnel 1
    Site-D-R-(config-if)#ip nhrp shortcut
    Site-D-R-(config-if)#exit
    Site-D-R-(config)#end






    Site-D-R-#traceroute 10.1.1.1 source fastEthernet 0/0

    Type escape sequence to abort.
    Tracing the route to 10.1.1.1

      1 192.168.1.1 56 msec 52 msec 72 msec


    Site-D-R-#traceroute 20.1.1.1 source fastEthernet 0/0

    Type escape sequence to abort.
    Tracing the route to 20.1.1.1

      1 192.168.1.1 56 msec 64 msec 56 msec
      2 192.168.1.2 128 msec 116 msec 100 msec


    Site-D-R-#traceroute 30.1.1.1 source fastEthernet 0/0

    Type escape sequence to abort.
    Tracing the route to 30.1.1.1

      1 192.168.1.1 56 msec 60 msec 72 msec
      2 192.168.1.3 128 msec 144 msec92 msec
    Read More
    Subscribe to: Posts (Atom)

    About me

    I am a CCIE Technical Instructor/Network, consultant. I am having experience of ranging from operating and maintaining PCs and peripherals to network control programs for multi-faceted data communication networks in LAN, MAN, and WAN environments.

    Popular Posts

    subscribe

    Enter your email address:

    Delivered by FeedBurner

    Copyrights @ MPLS - Distributed By Copy Blogger Themes - Blogger Templates By Templateism

    • routingswitching619@gmail.com
    • @EdgarFr18856619